--- schema: 1 kind: vulnerability title: "CVE-2026-124194, Microsoft Outlook: opening a crafted message file makes Outlook reach an attacker-chosen network location without the usual warning and disclose authentication information; exploited as a zero-day, fixed in the November 2026 updates and listed by CISA (CVSS 3.1 6.5)" headline: "Outlook zero-day CVE-2026-124194 exploited: a crafted message file leaks authentication data; install the Office update" summary: > Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw (CVSS 3.1 6.5) that Microsoft marks as exploited and not publicly disclosed and that CISA added to its Known Exploited Vulnerabilities catalog on 2026-11-10: a user who opens a crafted message file lets Outlook connect to an attacker-controlled location without the usual external-content warning, which can disclose authentication information. The Preview Pane is not an attack vector; BleepingComputer reports that the disclosed credential is the user's NTLMv2 hash, and no source names the actor or the victims. discovered_at: "2026-11-11T03:37:00Z" updated_at: null event_date: "2026-11-10" run_id: 2026-11-11T0256Z-intel priority: high immediate_action: null tags: [vulnerabilities, zero-day, info-disclosure, actively-exploited, cisa-kev, patch-available] regions: [global] sectors: [] entities: ["product:microsoft-outlook"] techniques: [T1566.001, T1204.002, T1187] affected_products: ["Microsoft Outlook", "Microsoft 365"] cves: - id: CVE-2026-124194 cvss: "6.5" epss: null type: info-disclosure vector: user-interaction auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21140 and Office LTSC 2021 before 16.0.14334.21048" fixed: "Office LTSC 2024 16.0.17932.21140; Office LTSC 2021 16.0.14334.21048; Microsoft 365 Apps through the Office security-update channel" sources: - url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194" publisher: "Microsoft (Security Update Guide)" date: "2026-11-10" role: primary - url: "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-122310" publisher: "ENISA EUVD (Microsoft CNA record)" date: "2026-11-10" role: corroborating - url: "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog" publisher: "CISA" date: "2026-11-10" role: corroborating - url: "https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/" publisher: "BleepingComputer" date: "2026-11-10" role: corroborating closed_sources: [] evidence: - quote: "Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user." publisher: "Microsoft" source_url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194" - quote: "Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector." publisher: "Microsoft" source_url: "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194" - quote: "Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability" publisher: "CISA" source_url: "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog" verification: multi-source sourcing_note: > Microsoft's record marks the flaw exploited and carries the fix; CISA's catalog listing is a separate confirmation. The Security Update Guide pages are a script-built application, so the record was read through Microsoft's update-guide API and the fixed builds are also cited to the CNA record at ENISA. BleepingComputer names the disclosed credential as the user's NTLMv2 hash; no source names the actor or the victims or describes the attacks. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Install the November 2026 Office updates on every Outlook installation now (Office LTSC 2024 to 16.0.17932.21140, Office LTSC 2021 to 16.0.14334.21048, Microsoft 365 Apps through its update channel), then check proxy and firewall logs back to the earliest message-file delivery you can find for Outlook connections to external SMB, WebDAV or HTTP destinations, and reset the accounts of any user whose session authenticated to one." updates: [] migrated_from: null --- Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw (CWE-356, the product does not warn the user of an unsafe action) scored CVSS 3.1 6.5, which the Security Update Guide marks as exploited and not publicly disclosed ([Microsoft, 2026-11-10](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194)). Microsoft's FAQ says an unauthenticated attacker sends a crafted message file and convinces the user to open it, whereupon Outlook may connect to an attacker-controlled network location without showing the usual external-content warning, "potentially disclosing authentication information that could be used to impersonate the user"; the Preview Pane is not an attack vector, so the file has to be opened ([Microsoft, 2026-11-10](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-124194)). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-10 ([CISA, 2026-11-10](https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog)), and BleepingComputer counts it as the one actively exploited zero-day of this Patch Tuesday ([BleepingComputer, 2026-11-10](https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/)). The affected products are Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2024 (fixed in 16.0.17932.21140) and Office LTSC 2021 (fixed in 16.0.14334.21048); Microsoft 365 Apps take the fix through the Office security-update channel ([ENISA EUVD, 2026-11-10](https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-122310)). BleepingComputer calls it an NTLM credential disclosure flaw: opening the attachment makes Windows connect to an attacker-controlled share and expose the user's NTLMv2 hash, which can be captured and cracked offline ([BleepingComputer, 2026-11-10](https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/)). No source names the actor or the victims. **Exposure:** every Outlook desktop below those builds; the build shows under File, Office Account, and the delivery path is mail or a download that carries a message file, which the user must open. **Detection:** outbound connections to non-corporate addresses over SMB (TCP 445), WebDAV or HTTPS from OUTLOOK.EXE or from the user's session shortly after a message-file attachment is opened, authentication events carrying the user's identity toward an external address, and mail-gateway logs for message-file attachments from unknown senders. Because the credential material may already have been captured before the patch, the check also covers the weeks before it. The disclosed material is the user's NTLMv2 hash, which can be cracked offline or used to impersonate the user, so also watch for later logons by the account from unfamiliar hosts. **Triage:** Outlook legitimately contacts SharePoint, OneDrive and corporate file servers; the discriminator is an external, non-corporate destination preceded by the opening of a message file. **Defender takeaway:** install the November Office update now rather than in the normal cycle, because the flaw is exploited and a patched machine still leaves earlier captured credentials valid; reset the accounts of users whose Outlook reached an external destination.